added permission model and spec for viewing project